Note: this is a practical guide for advertisers, not legal advice. For your specific case, speak to a data protection lawyer.

The short answer

In 30 seconds

You need a cookie banner that blocks advertising and analytics tags until the visitor agrees, with "reject" as easy as "accept". You need Google Consent Mode v2 connected to that banner, so Google can still model the conversions it cannot see. And every lead form needs a clear consent checkbox and a link to your privacy policy. A banner that blocks nothing is a legal risk; a banner that blocks everything without Consent Mode is a performance problem.

What the rules require

Portugal applies the GDPR and the EU ePrivacy rules, enforced by the CNPD, the national data protection authority. For advertisers, three principles matter:

  • Prior consent for any non-essential cookie or tag: analytics, advertising pixels, remarketing. Before the click on "accept", they should not fire.
  • Consent must be free and informed: rejecting must be as easy as accepting, with no pre-ticked boxes and no "by continuing to browse you accept".
  • A legal basis for every piece of personal data you collect, including the name and phone number in a lead form.

The most common problem we find is not a missing banner. It is a banner that looks right and does nothing: the Google tag and the Meta pixel load anyway, before the visitor clicks anything. That is the worst of both worlds: legally exposed, and the data still unreliable.

A banner that works shows "Accept" and "Reject" at the same level, with an option to choose categories; it actually holds back analytics and advertising tags until consent; it remembers the choice; and it lets people change their mind later through a link in the footer.

Google requires Consent Mode v2 for advertisers serving users in the European Economic Area who want to keep using features such as remarketing and audience measurement. It does two things:

  • It tells Google the consent state of each visitor (analytics, ad storage, ad user data, ad personalisation).
  • When a visitor refuses, Google receives cookieless signals and uses them to model the conversions it cannot observe directly.

The defaults must be set to "denied" before Google's tags load, and updated when the visitor makes a choice. If the order is wrong, the setup looks fine in the interface and quietly does not work.

Consent on lead forms

A lead form collects personal data, so it needs its own consent, separate from cookies:

  • A checkbox that is not pre-ticked, saying what the data will be used for ("to reply to this request").
  • A link to the privacy policy, in the same language as the form.
  • A separate checkbox for marketing if you want to send newsletters or offers later.
  • The same applies to Meta's instant forms: include your privacy policy and say clearly what happens next.

What it does to your numbers

Once consent works properly, some visitors refuse tracking, and your reports show fewer conversions than really happened. That is expected. Three things keep the damage small:

  • Consent Mode v2, so Google models the missing conversions.
  • Enhanced conversions, which send hashed contact data from your forms to improve matching.
  • Offline conversion imports from your CRM, which do not depend on cookies at all and tell Google which leads became customers.

And when comparing months, compare like with like: a drop in reported conversions the week you fixed your banner is a measurement change, not a performance one.

Checklist

Before you advertise

  • Does the banner offer "Reject" as clearly as "Accept"?
  • Do the Google tag and Meta pixel stay silent until consent? (Check in your browser's network tab.)
  • Is Consent Mode v2 set to "denied" by default, before Google's tags load?
  • Does every lead form have an unticked consent checkbox and a privacy policy link?
  • Is the privacy policy available in the language of your customers?
  • Are enhanced conversions or offline imports in place to recover lost data?

Not sure your tracking and consent are set up properly? We check both as part of a free account audit, and tell you in English what to fix first. Request a free audit →

Written by Pedro Macedo

Founder of Payoff Marketing. Managing Google Ads and Meta Ads campaigns in Portugal since 2009, with a background in statistics and information management (NOVA IMS, Lisbon).